Attention: macOS code signing!

Developer VST 3 SDK
1

Hi,
please make sure that if you code sign your plug-ins that the code signature is valid. We now see plug-ins that are signed, but with an invalid code signature which will trigger a crash on load in any hardened runtime enabled host.

To verify that your code signature is valid please run

codesign -v PLUGINPATH

The result should be either no output at all or

code object is not signed at all

Because unsigned code will still be loaded if allowed by the host, but invalid signed code will be rejected.

Cheers,
Arne

2

What’s the right option to choose there?

signing
signing989×598 68.8 KB

3

Could you elaborate how the host would allow that? Is there a way in 2021 with MacOS 11 that allows for unsigned a notarized code to be executed?

4

The post was from a time where macOS 11 was not available. For macOS 11 you need to code sign, but you can use “code sign to run locally” or via command line: “codesign - $pathToCodeSign”

5

Just to clarify: “code sign to run locally” only allows me to test the code on this local machine, but as soon as I want to give the alpha or beta version to someone else I need to have payed for an Apple Developer license and have someone at Apple notarize my code. Right?

6

Yes I think so.

8

As an author of many free VST plugin it really bites that I will now have to pay $99 a year to Apple just so that my free VST plugins can run on newer Macs. I know this is not VST fault but that still sucks :frowning: . Apple has finally found a way to make everybody pay even if you don’t publish your app and/or plugins in the store…

9

I believe you want Developer ID Application.

10

Old post but this might still be interesting…

“There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker”

Taken from here: https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/

11

Just wanted to add to this thread to say that even though code signing is optional on Windows, its highly recommended to sign plugins (and your applications of course).
If you don’t, you risk antivirus programs quarantining your plugins or even causing issues at runtime like slower load.

On Windows you have to pay for a third-party code signing certificate for your company that costs about $500 per year to maintain (less if you buy for more than a year). So, it’s actually more expensive than on Apple.

12

Way cheaper ← here??